feat(auth): single-admin password login (signed cookie) — gate tuning + Sources catalog, keep chat and document viewer public

tests/e2e/test_responsive_polish.py

@@ -45,6 +45,7 @@ from app.config import Settings
 from app.db import SessionLocal
 from app.rag.importer import ImportSummary, import_sources
 from app.rag.llm import LLMClient
+from e2e.auth_helpers import login
 
 REPO = Path(__file__).resolve().parents[2]
 FIXTURES = REPO / "tests" / "fixtures" / "docs"
@@ -206,7 +207,7 @@ def test_no_horizontal_overflow_at_viewports(
             )
             _assert_no_doc_overflow(page, f"chat @ {width}px")
 
-            page.goto(f"{app_url}/sources.html")
+            login(page, app_url, next="/sources.html")  # phase 16: admin-only
             page.locator("#docs-tbody tr").first.wait_for(state="visible", timeout=10_000)
             _assert_no_doc_overflow(page, f"sources @ {width}px")
         finally:
@@ -254,7 +255,7 @@ def test_sources_table_full_width(
     _reset_db(mock_llm, seed=True)
     page = browser.new_page(viewport={"width": 1280, "height": 800})
     try:
-        page.goto(f"{app_url}/sources.html")
+        login(page, app_url, next="/sources.html")  # phase 16: admin-only
         page.locator("#docs-tbody tr").first.wait_for(state="visible", timeout=10_000)
         wrap_box = page.locator(".table-wrap").bounding_box()
         shell_box = page.locator(".sources-shell").bounding_box()
@@ -268,7 +269,7 @@ def test_sources_table_full_width(
 
     mobile = browser.new_page(viewport={"width": 375, "height": 812})
     try:
-        mobile.goto(f"{app_url}/sources.html")
+        login(mobile, app_url, next="/sources.html")  # phase 16: admin-only
         mobile.locator("#docs-tbody tr").first.wait_for(state="visible", timeout=10_000)
         scroll, client = mobile.evaluate(
             "() => { const el = document.querySelector('.table-wrap');"
@@ -389,7 +390,8 @@ def test_contrast_pairs_pass_aa(
     _assert_aa(pairs["deflection"], "deflection ink on deflection bg")
 
     # Sources page: ink-soft/surface, white/brand (active nav).
-    page.goto(f"{app_url}/sources.html")
+    # (Phase 16: the stat cards are admin-only — sign in first.)
+    login(page, app_url, next="/sources.html")
     page.locator(".stat-card").first.wait_for(state="visible", timeout=10_000)
     pairs = page.evaluate(
         """() => {
@@ -498,7 +500,7 @@ def test_long_content_wraps_without_overflow(
     # Sources @ 360px: the long path ellipsizes, full path stays in `title`.
     phone = browser.new_page(viewport={"width": 360, "height": 740})
     try:
-        phone.goto(f"{app_url}/sources.html")
+        login(phone, app_url, next="/sources.html")  # phase 16: admin-only
         row = phone.locator("#docs-tbody tr", has_text="backup_rotation").first
         row.wait_for(state="visible", timeout=10_000)
         cell = row.get_by_role("cell").nth(1)